“You can’t buy this kind of publicity,” said Myrna Manners, New York Presbyterian Hospital’s Vice-President for Public Affairs, when the ABC series “NY Med” was first broadcast in 2012. As it turns out, it is that “this kind of publicity” can be very expensive. The Office of Civil Rights (“OCR”) of the U.S. Department of Health and Human Services announced a $2.2 Million settlement of HIPAA proceedings on April 19, 2016, for disclosure of the information of two patients whose treatment was broadcast on the show. One was dying, and the other was in severe distress. The settlement is significant because it represents a broadening of the criteria for patient-identifiable information that may not be disclosed without consent.
In January 2015, we reported that the family of a patient who had died while in the hospital, Mark Chanko, had filed compliant with OCR and a state law suit in Supreme Court of the State of New York on the ground that the ABC film makers had improperly disclosed Mr. Chanko’s identity while filming the treatment during which he expired. The family alleged that though Mr. Chanko’s face was obscured, his voice and other physical features were recognizable. The Appellate Division of the Supreme Court of the State of New York reversed the trial court’s decision to allow the suit to proceed, holding that that pixilation of the patient’s face and the lack of disclosure of his name indicated that there had been no improper disclosure of the patient’s identity. The HIPAA complaint was pending at the time of this decision.
It apparently has been resolved. While the identity of the deceased patient was not revealed in the OCR Resolution Agreement settling the proceeding, Law 360 reported on April 21, 2016, that the settlement comprised complaints of the family of a deceased patient and another who was filmed while in “severe distress.”
The Resolution Agreement requires, in addition to payment of $2.2 million, that the hospital enter into a Corrective Action Plan that will remain in effect for two years. Among its terms is a requirement that the hospital prepare new policies and procedures to protect patient privacy when the news media are on the premises, subject to OCR review, and that NYPH must revise its policies if OCR makes a request to do so within thirty days.
OCR has been ramping up its enforcement of the HIPAA Rules for some time, with audits and fines increasing in recent months. With the NYPH proceeding it has cast its net much wider, by proceeding against a hospital when the information disclosed is not the patient’s name, medical record information or even his or her digital image. Here, it was voice and other features that revealed the identity of the patient, albeit to only a few family members and their circle (though the fact that the information was broadcast to millions of television viewers undoubtedly played a large part in the determination to proceed). This is a clear warning to hospitals to revisit their definitions of protected patient information.
If you have questions regarding HIPAA compliance, or enforcement trends in the criteria for protected patient information, please contact Kenneth N. Rashbaum.
